huntrule

Suspicious node.exe Executing Compiled JavaScript Bytecode File

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-14
Updated
2026-10-14
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the Node.js runtime launching a compiled JavaScript bytecode file with the .jsc extension. Microsoft observed threat actors distributing malware as .jsc payloads run by node.exe to obfuscate their logic. Executing compiled bytecode hides the script source from defenders and evades signature detection, so this pattern flags likely malicious Node.js execution.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange
Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell
Malicious Fileless JavaScript Execution via Deno Data URI (via process_creation)
Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)
Suspicious PEAKLIGHT Memory-Only PowerShell Downloader Flags (via process_creation)
Suspicious Fake GIF Magic Header Written to Disguise Payload File (via process_creation)
Suspicious Base64 Decode Piped to Python Interpreter for In-Memory Execution (via process_creation)
Suspicious Thumbs.ini File Written to AppData by UNC2970 MISTPEN (via file_event)
Suspicious Chromium Browser Launch With Remote Debugging for DRILLAPP (via process_creation)
Suspicious node.exe Execution From LocalAppData Directory
Suspicious node.exe Executing Compiled JavaScript Bytecode File
Pivot detection · T1027 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.